Repository: thunderbird/thunderbird-android (language: kotlin)

Issue:
handling of embedded .eml files - inline vs attachment
### Checklist

- [X] I have used the search function to see if someone else has already submitted the same bug report.
- [X] I will describe the problem with as much detail as possible.

### App version

6.7.10

### Where did you get the app from?

Other

### Android version

13

### Device model

Pixel 7 Pro

### Steps to reproduce

[dmarc-embedded-as-eml.zip](https://github.com/thundernest/k-9/files/12558942/dmarc-embedded-as-eml.zip)

### Expected behavior

K-9 shows embedded mail like a quoted mail below the actual mail text.
K-9 allows me to see Names and Mailaddresses of all recipients.

### Actual behavior

I can't view/see the Mailaddresses of recipients of the quoted mail.

Ok in this case they are the same due to it being a dmarc protected mail, but you get the point.
If people forward you any email as embedded, then you should be able to read the addresses in it :)
(maybe even view the headers at some point but that's low prio to me)

Also there is the issue, that K-9 just drops the .eml on regular forward.
Only forwarding the .eml as an attachment works.

Though K-9 forwards mails as attachment like this:
```
------CRKHS6K8IK0190Y3APDX7NBAFZT2CK
Content-Type: message/rfc822;
 name="Re: Implementing bluetooth speakers on OpenWrt?.eml"
Content-Disposition: attachment;
 filename="Re: Implementing bluetooth speakers on OpenWrt?.eml";
 size=11297
```

For comparison, what the mailing list did:
```
--===============2691111782005021451==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
```

What do you think about forwarding mails as an attachment using `Content-Disposition: inline` instead of `Content-Disposition: attachment;`?

### Logs

_No response_


Discussion hints:
Interesting fact: Thunderbird shows embedded .eml files whether they are inline or attachments
Thunderbird also allows me to save the .eml file even when it's inline (K-9 does not)

EDIT:
I just realized that mixing two html mails (inlined) will also make them share their stylesheets which might mess up the layout?
Maybe there should still be a difference (don't inline attached .eml files by default) or we would need an extra viewport for each embedded mail? (separate DOMs)
or those separate DOMs could be realized via frames or something.

Pull request: HTML-encode header field values when displaying message/rfc822 parts
When displaying `message/rfc822` parts, the app displays certain header fields (From, To, Subject, etc). But we forgot to HTML-encode these values. So an email address with a display name, e.g. `Sender <sender@domain.example>` was rendered as `Sender` (because everything inside `<>` is treated as an HTML tag).

This pull request changes the code to use `TextUtils.htmlEncode()` to add the proper HTML encoding.

Fixes #7165

Test command: ./gradlew :app:core:testDebugUnitTest --tests "com.fsck.k9.mailstore.MessageViewInfoExtractorTest"

Fix patch:
diff --git a/app/core/src/main/java/com/fsck/k9/mailstore/MessageViewInfoExtractor.java b/app/core/src/main/java/com/fsck/k9/mailstore/MessageViewInfoExtractor.java
index b98c801464f..8b142e594be 100644
--- a/app/core/src/main/java/com/fsck/k9/mailstore/MessageViewInfoExtractor.java
+++ b/app/core/src/main/java/com/fsck/k9/mailstore/MessageViewInfoExtractor.java
@@ -6,6 +6,8 @@
 import java.util.Date;
 import java.util.List;
 
+import android.text.TextUtils;
+
 import androidx.annotation.Nullable;
 import androidx.annotation.VisibleForTesting;
 import androidx.annotation.WorkerThread;
@@ -347,7 +349,7 @@ private void addHtmlDivider(StringBuilder html, Part part, boolean prependDivide
             String filename = getPartName(part);
 
             html.append("<p style=\"margin-top: 2.5em; margin-bottom: 1em; border-bottom: 1px solid #000\">");
-            html.append(filename);
+            html.append(TextUtils.htmlEncode(filename));
             html.append("</p>");
         }
     }
@@ -540,10 +542,10 @@ private void addMessageHeaderHtml(StringBuilder html, Message message)
      */
     private static void addTableRow(StringBuilder html, String header, String value) {
         html.append("<tr><th style=\"text-align: left; vertical-align: top;\">");
-        html.append(header);
+        html.append(TextUtils.htmlEncode(header));
         html.append("</th>");
         html.append("<td>");
-        html.append(value);
+        html.append(TextUtils.htmlEncode(value));
         html.append("</td></tr>");
     }
 


Test patch:
diff --git a/app/core/src/test/java/com/fsck/k9/mailstore/MessageViewInfoExtractorTest.java b/app/core/src/test/java/com/fsck/k9/mailstore/MessageViewInfoExtractorTest.java
index 6de424caa23..8d5a057a8a3 100644
--- a/app/core/src/test/java/com/fsck/k9/mailstore/MessageViewInfoExtractorTest.java
+++ b/app/core/src/test/java/com/fsck/k9/mailstore/MessageViewInfoExtractorTest.java
@@ -251,16 +251,16 @@ public void testTextPlusRfc822Message() throws MessagingException {
         // Create message/rfc822 body
         MimeMessage innerMessage = new MimeMessage();
         innerMessage.addSentDate(new Date(112, 2, 17), false);
-        innerMessage.setHeader("To", "to@example.com");
-        innerMessage.setSubject("Subject");
-        innerMessage.setFrom(new Address("from@example.com"));
+        innerMessage.setHeader("To", "Recipient <to@example.com>");
+        innerMessage.setSubject("Subject with characters that need HTML encoding: \"&<>");
+        innerMessage.setFrom(new Address("from@example.com", "Display name & email address"));
         MimeMessageHelper.setBody(innerMessage, innerBody);
 
         // Create multipart/mixed part
         MimeMultipart multipart = MimeMultipart.newInstance();
         MimeBodyPart bodyPart1 = new MimeBodyPart(textBody, "text/plain");
         MimeBodyPart bodyPart2 = new MimeBodyPart(innerMessage, "message/rfc822");
-        bodyPart2.setHeader("Content-Disposition", "inline; filename=\"message.eml\"");
+        bodyPart2.setHeader("Content-Disposition", "inline; filename=\"message&special_char.eml\"");
         multipart.addBodyPart(bodyPart1);
         multipart.addBodyPart(bodyPart2);
 
@@ -277,12 +277,12 @@ public void testTextPlusRfc822Message() throws MessagingException {
         String expectedText =
                 BODY_TEXT +
                 "\r\n\r\n" +
-                "----- message.eml ------------------------------------------------------" +
+                "----- message&special_char.eml -----------------------------------------" +
                 "\r\n\r\n" +
-                "From: from@example.com" + "\r\n" +
-                "To: to@example.com" + "\r\n" +
+                "From: Display name & email address <from@example.com>" + "\r\n" +
+                "To: Recipient <to@example.com>" + "\r\n" +
                 "Sent: Sat Mar 17 00:00:00 GMT+01:00 2012" + "\r\n" +
-                "Subject: Subject" + "\r\n" +
+                "Subject: Subject with characters that need HTML encoding: \"&<>" + "\r\n" +
                 "\r\n" +
                 innerBodyText;
         String expectedHtml =
@@ -290,20 +290,20 @@ public void testTextPlusRfc822Message() throws MessagingException {
                         BODY_TEXT_HTML +
                 "</pre>" +
                 "<p style=\"margin-top: 2.5em; margin-bottom: 1em; border-bottom: " +
-                        "1px solid #000\">message.eml</p>" +
+                        "1px solid #000\">message&amp;special_char.eml</p>" +
                 "<table style=\"border: 0\">" +
                 "<tr>" +
                 "<th style=\"text-align: left; vertical-align: top;\">From:</th>" +
-                "<td>from@example.com</td>" +
+                "<td>Display name &amp; email address &lt;from@example.com&gt;</td>" +
                 "</tr><tr>" +
                 "<th style=\"text-align: left; vertical-align: top;\">To:</th>" +
-                "<td>to@example.com</td>" +
+                "<td>Recipient &lt;to@example.com&gt;</td>" +
                 "</tr><tr>" +
                 "<th style=\"text-align: left; vertical-align: top;\">Sent:</th>" +
                 "<td>Sat Mar 17 00:00:00 GMT+01:00 2012</td>" +
                 "</tr><tr>" +
                 "<th style=\"text-align: left; vertical-align: top;\">Subject:</th>" +
-                "<td>Subject</td>" +
+                "<td>Subject with characters that need HTML encoding: &quot;&amp;&lt;&gt;</td>" +
                 "</tr>" +
                 "</table>" +
                 "<pre class=\"k9mail\">" +